iOS: Why a Widget Can Poison the Next Boot
PHANTOM finds the same lifecycle trust-boundary problem on iOS, but not the same Android mechanisms. This chapter compares two iOS processing boundaries: ordinary bundle and extension consumers that read metadata on demand, and the early-boot Widget path in which chronod scans installed metadata before the operating system’s recovery behavior is fully established. The distinction explains why some tested values caused recoverable service disruption while a Widget value could produce a persistent boot failure, and why the delivery and patch-status claims must remain carefully qualified.
On-demand consumers: a metadata failure can disrupt one service
The iOS cases begin with a value in an application or extension Info.plist. The study reports that a 256 MB value in a tested field can cause a privileged consumer to exceed its Jetsam high-water mark. Jetsam is iOS’s memory-management system for protecting device responsiveness: it terminates a process that exceeds its permitted memory level, even when that process is a high-priority system daemon.
The immediate mechanism is therefore different from Android’s Binder overflow. Android’s critical boundary in the cases examined earlier is a bounded inter-process message or persistence encoding. The iOS boundary is the amount of memory a daemon attempts to use while materializing a property-list value. The shared pattern is the earlier acceptance of attacker-controlled metadata and the later absence of a bound that matches the consumer’s actual representation.
For core application bundles, the paper identifies consumers such as SpringBoard, installd, LaunchServices, and related installation services. These components may need bundle identity, display information, version values, or other system-facing metadata while placing the application, indexing it, presenting it, or managing its lifecycle. The application does not have to be running for the system to need those values. When the consumer allocates or processes an oversized value, Jetsam can terminate it.
A terminated service is normally restarted by the system. In an on-demand path, that restart does not automatically create a boot failure. It can still make a feature unstable, interrupt an installation or user-interface action, or leave the device without a service until the metadata is removed. The paper classifies the core-bundle examples as L2 partial service disruption in the tested cases. The label means the device remains generally usable even though a nontrivial system function is degraded; it does not mean that the value is harmless.
One example shows how a metadata problem can interfere with its own removal. The study reports that an oversized CFBundleDisplayName can affect the interface used to delete the application. Removing an application requires the system to render a confirmation path that includes the application’s name. If the display name causes the Settings interface to fail during that work, the user may be unable to complete the ordinary uninstall flow through the UI. The malicious metadata remains in the bundle, so attempts to interact with the application can continue to encounter the same value.